How to force password change?

Tri · Post by **Tri** » Tue May 17, 2005 12:05 pm

You have told me you have filed a feature request for Vault password expiry. Thanks, I hope we'll have this feature soon.

In the mean time, we would like to force all Vault users to change the pwd, each user has a different pwd. Is there anyway to automate the process?

- Write a SQL script?

- Write a .NET program using Vault API?

- Calling CLC?

If it is possible, please help us with some leads on how to implement. Thanks.

Post by **jeremy_sg** » Tue May 17, 2005 1:12 pm

We don't have a timeframe set for including password expiration, but it will most likely not be soon. For users who want full featured control over password expiration and complexity, I would recommend using Active Directory authentication, which uses Active Directory to validate the password typed into the Vault login dialog. You can set AD to expire passwords and enforce password complexity.

There's no way to force a user to change his password the next time that he logs on to Vault. The admin user could reset their passwords at once, but that might not be what you want.

Tri · Post by **Tri** » Tue May 17, 2005 2:23 pm

Half of our staff work off site and cannot always VPN in.

jeremy_sg wrote:The admin user could reset their passwords at once, but that might not be what you want.

Do you mean using the Admin tool, Edit user properties and changing the pwd manually? If I want a different pwd for each user, then I guess I should repeat the same process for each user. Correct?

Post by **jeremy_sg** » Wed May 18, 2005 8:32 am

You do not need to be logged in to the AD domain when using AD authentication. The user can put in his domain username and password into the login dialog, and the client encrypts it and sends it to the server. The server (which is on the domain), then authenticates that username and password against AD. It was specifically coded this way to allow clients that are not on the domain to use AD passwords.

Tri · Post by **Tri** » Wed May 18, 2005 8:50 am

I have created UserX, pwd=PwdX using Vault Admin Tool.

The user now logs in using Vault Client and type:
User = Domain\HisWindowsLogin
Pwd = his AD pwd

The user/pwd I have created (UserX/PwdX) will be never used. Should I rename UserX to Domain\HisWindowsLogin? If so, should I leave the pwd blank?

Post by **jeremy_sg** » Wed May 18, 2005 9:35 am

The method for setting up AD auth for a user is this:

1. Make sure that you have the domain specified for the server computer (in the Vault Admin tool, under server options), and that you are impersonating a domain user (You can use IdentitySwitcher to change the impersonation. Seehttp://support.sourcegear.com/viewtopic ... tyswitcher)
2. The vault username must match the windows domain user name, so if your domain user name is DOMAIN\HisUserName, then the Vault user name should be HisUserName, and the DOMAIN should be specified in the admin tool.
3. In the Vault client login screen, the username will just be HisUserName, and the password will be the domain password.

Two things you should know after you get this set up.

1. Vault can't warn a user when their AD password is about to expire.
2. Vault can't change a user's AD password.

Tri · Post by **Tri** » Wed May 18, 2005 10:59 am

So is the AD authentication a Vault server wide setting?

Is it possible to mix both authentication methods? (We have some temporary users who doesn't have AD account)

Post by **jeremy_sg** » Wed May 18, 2005 11:03 am

Yes, it's possible. I forgot to metion above, that you need to edit the user in the Admin tool and check the Authenticate using Active Directory check box. Only users who have this checked will be authenticated against AD.